How to throttle login attemps in Java webapp?

Posted by Jörn Zaefferer on Stack Overflow See other posts from Stack Overflow or by Jörn Zaefferer
Published on 2009-01-19T13:33:23Z Indexed on 2010/04/10 14:53 UTC
Read the original article Hit count: 611

Filed under:

java

|

login

|

throttle

|

Throttling

I want to implement an efficient mechanism to throttle login attemps in my Java web application, to prevent brute-force attacks on user accounts.

Jeff explained the why, but not the how.

Simon Willison showed an implementation in Python for Django: That doesn't really help me along as I can't use memcached nor Django.

Porting his ideas from scratch doesn't seem like a great either - I don't want to reinvent the wheel.

I found one Java implementation, though it seems rather naiive: Instead of a LRU cache, it just clears all entries after 15 minutes.

EHCache could be an alternative for memcached, but I don't have any experience with it and don't really want to intoduce yet another technology if there are better alternatives for this task.

So, whats a good way to implement login throttling in Java?

© Stack Overflow or respective owner

Related posts about java

Tomcat 6: Access Control Exception?

as seen on Server Fault - Search for 'Server Fault'
I'm trying to setup a tomcat6 server, and I'm trying to match another setup someone else established. However, my deployment (default Ubuntu install) uses a policy.d/ directory structure, and the established server just uses a catalina.policy file. I've tried setting every entry in policy.d to match… >>> More
Problem in creation MDB Queue connection at Jboss StartUp

as seen on Stack Overflow - Search for 'Stack Overflow'
I am not able to create a Queue connection in JBOSS4.2.3GA Version & Java1.5, as I am using MDB as per the below details. I am putting this MDB in a jar file(named utsJar.jar) and copied it in deploy folder of JBOSS, In the test env. this MDB works well but in another env. [ env settings and… >>> More
failing to establish connection between Postgres db and gwt

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I am using Postgres and gwt 2.0 for one of my applications. I am facing problem connecting to the database. When I try to connect it gives "ClassNotFoundException". Here is what I get when I try to connect to database: java.lang.ClassNotFoundException: org.postgresql.Driver at java.net… >>> More
failing to establish connection between postgre db and gwt

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, For i am using postgre and gwt 2.0 for one of my applications. I am facing problem connecting to the database. When i try to connect it gives "ClassNotFoundException". Here is what i get when i try to connect to database: java.lang.ClassNotFoundException: org.postgresql.Driver at java.net… >>> More
Migration and deployement problems JBoss 4.2.2.GA to JBoss 6.0.0.M2

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I'm trying to migrate an application running on JBoss 4.2.2.GA to JBoss 6.0.0.M2 I give you some log to explain my problem : boot.log : 2010-03-16 09:59:29,406 ERROR [org.jboss.system.server.profileservice.ProfileServiceBootstrap] (Thread-2) Failed to load profile: Summary of incomplete deployments… >>> More

Related posts about login

login to account reverts to login screen, guest login ok

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
When I get to the login screen, I put my password, and I only get a black screen for 2 seconds, then we're back at the login screen. When I log in to the guest account everything works perfectly. What I've tried; I deleted .Xauthority as per instructions from elsewhere. No luck I removed 2 lines… >>> More
How to login as other in ubuntu 12.04

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
i have upgraded my ubuntu 11.10 to 12.04. i could not see other login option in the login screen. it shows only Guest login and User login. The User Login ask only password and i had never entered in as User login so that i do not know about password of User login. my problem is how to login as root… >>> More
Redmine on Apache2 with Passenger issue

as seen on Server Fault - Search for 'Server Fault'
I installed Redmine and run it in Apache2 with the Passenger module. Apache2 boots, Passenger module gets loaded and the Redmine welcome page is shown, however when trying to login or navigate to other parts of the Redmine site, the browser keeps loading and loading and loading forever, although the… >>> More
Fedora 12 - login panel: disable automatic login

as seen on Super User - Search for 'Super User'
Hello Everybody I have just replaced my FC11 by the FC12. To put skype up and running I used autoten and choose to not have the automatic login enable. After running it the skype was working nicely. However the next time I restarted the machine, on the login panel appeared ""automatic login"" option… >>> More
Automating Form Login

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Introduction A common task in configuring a web application for proxying in Pagelet Producer is setting up form autologin. PP provides a wizard-like tool for detecting the login form fields, but this is usually only the first step in configuring this feature. If the generated configuration doesn't… >>> More